Potential security flaw

[The Toxic Mite]

Hey all.

I found a spambot thread a few minutes ago. I was wondering how they could register. So I logged out, went to the registration form, and I saw why.

The "Random Question" should be replaced with a Captcha. Captchas are more difficult for spambots to crack, and therefore more secure.

Anyone agree with me here?

[matthew]

http://www.w3.org/TR/turingtest/

Captchas do not pass accessibility standards and we desire for all who wish to be able to access our forums. Plus, our members do an amazing job of reporting any spammers who get through and that sort of thing is dealt with quite rapidly, so this isn't really an issue.

[Frak]

As Matthew said, CAPTCHAs aren't accessible. While they can be hard to crack (take reCAPTCHA for instance), those who are blind cannot solve them. Since this is a support forum, it should cater to anyone, regardless of their abilities or disabilities.

[lisati]

I sometimes have trouble with captchas, particularly when the letters are squashed together. Then again, sometimes the random questions spark some discussions.....

Examples:
http://ubuntuforums.org/showthread.php?t=867599
http://ubuntuforums.org/showthread.php?t=879616

[aysiu]

It's been a few years since I registered. Do we send an email to a valid email account that then needs to be clicked on to validate the account? Does that even work to stop spambots, or do they also automatically create email accounts?

[Tamlynmac]

The creation of an online e-mail account (IMHO) should not be confused with security. I doubt, many would argue that creating an e-mail account can easily be accomplished with the primary objective being - deception. If one is truly concerned about spambots, an alternative solution to the use of e-mail accounts (as a deterrent) should be implemented. Assuming, a solution that encompasses the needs of all potential forum members is available.

It's been my experience that the staff is quite efficient regarding spam removal. Usually, it occurs prior to my reporting it. Obviously, the staff is cognizant of the need for vigilance and takes it seriously.

Since the forum is not inundated with spam, might I point out that the staff have proven to be an effective deterrent. I sincerely doubt the implementation of any protection procedure will prove 100% reliable. Since the staff has already shown a propensity to provide forum members with a pleasant experience (spam free), might I suggest that any future procedure(s) include direct staff involvement and not be left solely to automation.

The complexity of this forum's security must be staggering when one considers the volume and diversity of it's membership. Implementation of security procedures must include multiple variables and disabilities. I don't envy those members of the staff that may be assigned the daunting task of seeking solutions to this issue. I suspect it will prove to be - quite a challenge.

Just my $0.02

[OrangeCrate]

As Matthew said, CAPTCHAs aren't accessible. While they can be hard to crack (take reCAPTCHA for instance), those who are blind cannot solve them. Since this is a support forum, it should cater to anyone, regardless of their abilities or disabilities.

An interesting argument, but I'm curious how the blind answer the "random questions" The Toxic Mite mentioned?

[Grenage]

I hate captchas with a passion. Those with 20-20 vision end up answering anywhere from 1-10!

[matthew]

An interesting argument, but I'm curious how the blind answer the "random questions" The Toxic Mite mentioned?
Browsers that read the text out loud.

[OrangeCrate]

Browsers that read the text out loud.

Of course, I never thought of that. Now I see what you guys are talking about.

[The Toxic Mite]

Browsers that read the text out loud.

reCAPTCHA can read out loud as well!

[Elfy]

reCAPTCHA can read out loud as well!

But are they as hard to read as captchas? I hate the things with a passion

[bodhi.zazen]

We have ways to manage spam bots without using a Captcha.

I agree with matthew, the community does a good job at reporting spam and in general spam is managed very rapidly.

[Frak]

reCAPTCHA can read out loud as well!
They're just as impossible to understand.

Here's a sample from an actual reCAPTCHA CAPTCHA code.
http://www.mediafire.com/?nqnmdkx1fot